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SYSTEM FOR COMMUNICATING WITH 
ELECTRONIC EQUIPMENT 

Cross -Reference to Related Applications 

This application is a continuation of U.S. patent application Serial No. 
09/370,430 filed August 9, 1999 which is a continuation-in-part under 
35U.S.C.§111 and §120 of international application PCT/US99/07846, filed 
April 8, 1999, designating, inter alia, the United States, and which claims the 
benefit of U.S. provisional application No. 60/081279 filed April 10, 1998. 

BACKGROUND OF THE INVENTION 

1. Technical Field 

This invention relates generally to computer networks and, more 
particularly, to a network management and security system for managing, 
tracking, and identifying remotely located electronic equipment on a network. 

2. Discussion 

Over the last several years, one of the largest problems in managing the 
computerized office environment has been identified as controlling the Total 
Cost of Ownership, or TCO, of the office computer. Controlling TCO includes 
not only the cost of the asset but also all costs associated with that asset, such 
as support costs, software costs, and costs due to loss or theft, including 
hardware, software, and most importantly, information. 

An aspect of the support costs of TCO is asset movement. Today, 
many employees have more than one computer. When that employee is 
moved to another location, the assets must be moved as well. A typical 
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organization can have as much as 40% of its employees move from one 
location to another over the course of a year. When these movements occur 
daily, tracking each asset over time is nearly impossible. There is also the 
unauthorized movement of assets, such as moving an asset from an 
employee's office to his or her associated lab area. In addition to these 
physical movements, the asset may also be changed over time through 
hardware and software modifications. Even if an asset is successfully tracked 
over a period of time, the asset may not be the same at the end of the period. 
Due to this constant asset relocation and reorganization, an organization may 
not always know where all of its assets are located. In fact, it is very likely that 
a company may not even know how many assets they own or if those assets 
are still in their possession. Additionally, an organization that desires to send a 
message to all of the assets within a particular physical area is limited to relying 
on databases that correlate the network identification of an asset to where that 
asset should be located, not where the asset actually is located. Previous 
attempts to provide asset tracking and management have relied on software 
solutions that have proven to be fundamentally flawed. Asset tracking and 
management software is limited in a number of important areas. It is generally 
incapable of detecting the electrical connection status of equipment, it cannot 
detect the physical location of equipment, the identifying name of equipment is 
not permanent, and the monitored assets must be powered-up. 

Therefore, a method for permanently identifying an asset by attaching 
an external or internal device to the asset and communicating with that device 
using existing network wiring or cabling is desirable. Also, it is desirable to 
communicate with an asset based upon the physical location of the asset. 
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Additionally, a method of determining when an asset is being removed or 
added to the network is desirable. It would also be desirable to communicate 
with the device without requiring the device or the asset to be connected to 
alternating current (AC) power. Such a device would allow a company to track 
its assets, locate any given asset, and count the total number of identified 
assets at any given time, thus significantly reducing its TCO of identified assets. 

One method that attempted to control the hardware theft aspect of TCO 
is disclosed in U.S. Pat. No. 5,406,260 issued to Cummings et. al, (hereby 
incorporated by reference) which discusses a means of detecting the 
unauthorized removal of a networked device by injecting a low current power 
signal into each existing communications link. A sensor monitors the returning 
current flow and can thereby detect a removal of the equipment. This method 
provides a means to monitor the connection status of any networked electronic 
device thus providing an effective theft detection/deterrent system. 

It would, however, be desirable to provide a further means in which a 
networked device may also be identified by a unique identification number 
using the existing network wiring or cabling as a means of communicating this 
information back to a central location. More particularly, it is desirable to provide 
a means for identification that feasibly employs the same cable (and, if desired, 
the same wires in the cable) that normally carries high frequency data 
communications in an existing network. In addition, it is desirable to provide an 
identification system that is easily and inexpensively implemented in an existing 
network system. 

The theft of information is a further aspect of TCO. Today, the most 
important resources a company has are its employees and the information that 
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they create and accumulate. Information that is available on a company's 
internal network can range from personnel files and corporate business plans to 
research and development efforts related to new products. Restricting access 
to sensitive or confidential information such as personnel files is a high priority 
for all companies. The use of passwords and limiting access to certain types of 
information to particular computer stations are typical methods that companies 
employ to protect information. These passive methods of protecting company 
information are sufficient to prevent technically unknowledgeable people from 
gaining access to protected information. However, these methods are usually 
unable to protect information from a technically knowledgeable person with 
specialized electronic equipment. The existence of an unauthorized device 
connected to the company network may indicate the presence of someone with 
electronic equipment that has the capability to defeat a company's internal 
security measures. A method of blocking communications with such a device 
connected to a network is desirable. Further, automatically blocking 
communications with an unauthorized device is desirable. An active system 
that interrogates the devices connected to a network and blocks 
communications with unauthorized devices would provide enhanced security 
for sensitive information. 

A further aspect of support costs is the cost associated with utilization of 
network bandwidth. Today, the bandwidth of most networks is being constantly 
increased to meet the increasing need to transmit large quantities of data. In 
order to provide the required bandwidth costly hardware upgrades must be 
purchased resulting in an increase in the TCO. To reduce the need for 
hardware upgrades the use of available network bandwidth is dedicated to data 
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that is required for the operation of application programs. Using valuable 
network bandwidth to provide a means of identifying assets would either limit 
the availability of bandwidth for application programs or require the purchase of 
new hardware. Additionally, using network bandwidth for asset identification 
would limit the identification system to operating only when the asset has AC 
power applied. Assemblies within the asset would have to be operational in 
order to transmit data over the network. Requiring power to be applied to every 
monitored asset would limit the capability to identify ail the assets connected to 
a network at any particular time. Therefore, it is desirable to provide a means 
for asset identification that does not use existing network bandwidth. Such a 
device would more fully utilize existing network resources without increasing the 
TCO associated with network bandwidth. 



SUMMARY OF THE INVENTION 
In accordance with the teachings of the present invention, a 
communication system is provided for generating and monitoring data over a 
pre-existing wiring or cables that connect pieces of networked computer 
equipment to a network. The system includes a communication device or 
remote module attached to the electronic equipment that transmits information 
to a central module by impressing a low frequency signal on the wires of the 
cable. A receiver in the central module monitors the low frequency data to 
determine the transmitted information from the electronic equipment. The 
communication device may also be powered by a low current power signal from 
the central module. The power signal to the communication device may also 
be fluctuated to provide useful information, such as status information, to the 
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communication device. Relocation of the electronic equipment with the 
attached communication device to another location on the network is detected 
immediately and may be used to update a database. This invention is 
particularly adapted to be used with an existing Ethernet communications link 
or equivalents thereof. 

BRIEF DESCRIPTION OF THE DRAWINGS 
Other objects and advantages of the present invention will become 

apparent to those skilled in the art upon reading the following detailed 

description and upon reference to the drawings in which: 

FIG 1 is a general block diagram that illustrates a network that includes a 

communication system in accordance with a first embodiment of the present 

invention; 

FIG. 2 is an exploded perspective view that illustrates installation of the 
central module into an existing computer network in accordance with the first 
embodiment of the present invention; 

FIG. 3 is a block diagram that illustrates the first embodiment of the 
present invention; 

FIG. 4 is an interconnection diagram that illustrates a second 
embodiment of the present invention; 

FIG. 5 is a block diagram that illustrates a central module made in 
accordance with the teachings of the present invention; 

FIG. 6 is a detailed schematic diagram of the central module in 
accordance with the second embodiment of the present invention; 

FIG. 7 is a block diagram that illustrates a remote module made in 
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accordance with the teachings of the present invention; 

FIG. 8 is a detailed schematic diagram that illustrates a central module 
in accordance with the second embodiment of the present invention; 

FIG. 9 is a diagram that illustrates alternate circuits for blocking 
communications in accordance with an embodiment of the present invention; 

FIG. 10 is a detailed schematic diagram which illustrates a remote 
module and a central receiver module coupled to a network in accordance with 
the third embodiment of the present invention; 

FIG. 1 1 is a perspective view of one embodiment of the hardware for the 
remote module; 

FIG. 12 is an exploded perspective view of the hardware of FIG. 11; 
FIG. 13 is a cross-sectional view of the hardware shown mounted to a 
computer; 

FIG. 14 is a perspective view of an alternative embodiment of the 
hardware for the remote module; 

FIG. 15 illustrates the installation of the hardware of FIG. 14 into a 
computer; 

FIG. 16 is a schematic representation of an electronic tether in 
accordance with the fourth embodiment; 

FIG. 17 is a cross-sectional view of an electronic tether used in 
connection with the fourth embodiment; 

FIG. 18 is a schematic representation of circuitry for the fourth 
embodiment; 

FIG. 19a is a block diagram that illustrates a system for electronically 
identifying an object made in accordance with the teachings of the present 



9919-000002/COC 

8 

invention; 

FIG. 19b is a cross-sectional view of an ID sender tag used in 
connection with the system for electronically identifying an object; 

FIG. 20 is a schematic representation of circuitry used in a system for 
electronically identifying an object; 

FIG. 21 is a perspective view that illustrates installation of an ID sender 
tag and decoder plug; and 

FIG. 22 is a perspective view that illustrates an ID sender tag and 
decoder plug interconnected by a serial bus. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
Four embodiments of the invention are illustrated within this 
specification. The first embodiment illustrates the general teachings of the 
invention, whereas the second, third, and fourth embodiments depict specific 
implementations of the teachings. Turning now to FIGS. 1, 2 and 3, a first 
embodiment of a central module 15 and remote module 16 system is provided 
therein for achieving identification of electronic computer equipment associated 
with a computer network 17. Although, the first embodiment depicts merely 
communicating equipment identification information, the principles of the 
invention may be readily extended to include the communication of more 
general information such as identification of the equipment processor type and 
the equipment harddrive capacity. In general, the central module 15 monitors 
remote module circuitry 16 that may be permanently attached to remotely 
located electronic workstations such as personal computers 3A through 3D 
over the computer network 17. The communication system 15 and 16 
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described herein is particularly adapted to be easily implemented in conjunction 
with an existing computer network 17 while realizing minimal interference to the 
computer network. In addition to being implemented from the hub of a network 
to remotely located PCs, the invention can be applied to other elements of an 
office environment such as telephones, fax machines, robots, and printers. 
The invention is particularly suitable for being incorporated into a patchpanel. 
The asset aware patchpanel would then be capable of identifying the existence 
and location of network assets without power being applied to the assets. 

Remotely located personal computers 3A through 3D are each 
connected to the computer network 17 so as to provide widespread remote 
user access to the computer network 17. The remotely located personal 
computers 3A through 3D are shown connected to hub 1 via data 
communication links 2A through 2D. Data communication links 2A through 2D 
are, for example, conventional multi-wire cables that include a plurality of 
transmit and receive data communication links (sometimes referred to herein 
as wires or lines) for communicating information between each of remotely 
located computers 3A through 3D and other communication devices on the 
network such as other computers and file servers (not shown). 

The invention described herein is particularly suited to be implemented 
in conjunction with a computer network 17 which preferably employs a 
conventional wiring approach of the type which may include twisted pair wiring 
such as Ethernet, Token Ring, or ATM. Wiring schemes similar to Ethernet are 
commonly employed to provide data communication links for electronic 
computer equipment. In accordance with conventional wiring or cabling 
approaches, data communication links 2A-2D generally include a pair of 
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transmit wires (not shown) as well as a pair of receive wires (not shown) 
connected to each of personal computers 3A through 3D. The cable may 
include other wires, as well. Each pair of transmit and receive wires are 
internally coupled to an associated personal computer via two windings of an 
internally located isolation transformer (not shown). Each pair of transmit wires 
and each pair of receive wires thereby form a current loop through one of the 
personal computers 3A through 3D which is advantageously employed in 
accordance with the approach described herein. 

The central module 15 includes an isolation power supply 8 (see FIG. 3) 
which supplies a continuous direct current (DC) power supply to each of current 
loops 2A through 2D. The DC power supply has a low current preferably on the 
order of magnitude of about 1 mA. The isolation power supply 8 includes an 
input terminal for receiving a low voltage signal V L v which has a magnitude of 
approximately fifteen (15) volts. The present embodiment of the invention 
sources DC current from the 15 volt source to the remote modules 16. 
However, it is within the scope of the invention to provide other voltage levels 
such as 3V dc, and 20V dc. Although the present embodiment sources current 
for the immediate power needs of the remote module, it is also within the scope 
of the invention to supply current to charge a battery, capacitor bank, or other 
energy storage device that powers the remote module. Additionally, powering 
the remote module from some other source such as a primary battery, 
rechargeable battery or capacitor bank that receives energy from a source 
other than the central module is within the scope of the invention. 

The power generated by isolation power supply 8 is passed through 
signal modulator 7 which can slightly alter the voltage supplied by isolation 
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power supply 8 based upon status data provided by the status data encoder 9. 
Status data encoder 9 receives its status data from the firmware kernel 4. 
Signal modulator 7 inserts this low power supply across the transmit and 
receive lines or into either the transmit lines or the receive lines in order to 
supply the remote module 16 with both status information and power. The 
scope of the invention includes transmitting status information as a single bit or 
as a pulse train. Types of transmitted status information include whether the 
protection circuit is active, date, time, and port location. It is also within the 
scope of the invention to encode the status data using methods such as single 
bit on/off, Manchester, 4B/5B, and Frequency Shift Keying (FSK). 

Isolation power supply 13 draws power for the remote module 16 and 
provides status information that was encoded into the power supply signal by 
signal modulator 7 within the central module 15. This status information is in 
turn passed over to the firmware kernel 10 of the remote module 16 by way of 
the status data reader 14. 

Firmware kernel 10 provides a preprogrammed unique identification 
number to Manchester encoder 11 in order to reliably traverse the data 
communication link or cable 2A. The Manchester encoder then passes this 
encoded number to signal transmitter 12 which sends the encoded number 
across the data communication link 2A by altering the total current draw of the 
remote module 16. Although the present embodiment of the invention uses 
Manchester encoding, the principles of the invention may be readily extended 
to other encoding techniques such as Frequency Shift Keying, 4B/5B, PAM5x5, 
8B/6T, Polar NRZ, and Bipolar. Additionally, waveshaping the encoded signal 
with techniques such as MLT-3 is within the scope of the invention. In addition 
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to transmitting an identification number the firmware kernel 10 may also elect to 
send additional information such as confirmation of the status information or 
additional data provided by an external device 18, such as the computer 3A to 
which the remote module 16 is attached. 

The information sent from the remote module 16 is received by the 
signal receiver 6 within the central module 15, decoded by Manchester decoder 
5, and passed on to the firmware kernel 4. The firmware kernel may now pass 
this received information on to an external device 19, such as a computer 
responsible for asset tracking. 

Kernel 4 may optionally provide a blocking signal to blocking circuit 20 to 
deny, to an unauthorized computer, access to the network information via hub 
1. For example, if someone uses a laptop to attempt to plug into the network, 
the central module 15 detects the absence of the proper identification code 
from the laptop and, as noted before, kernel 4 would issue a suitable signal to 
blocking circuit 20 to prevent access to the network information and also 
generate an alarm. Furthermore, if the potential thief later disconnects 
protected equipment from the network, this action is also detected and an 
alarm can be generated. Although the present embodiment illustrates the 
blocking function as shorting the data lines together 131 (see Fig. 9), it is within 
the scope of the invention to implement blocking by other means, such as 
opening both lines of the transmit or receive data lines 130, opening one of the 
data lines 132, and transmitting noise onto the data lines 134. 

Figs. 4-8 illustrate a second embodiment of the invention which 
generally differs from the first embodiment by having circuitry that transmits a 
modulated signal directly to central module 15a from remote module 16a. In 
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the first embodiment current sourced from central module 15 to remote module 
16 is modulated within remote module 16 and then returned to central module 
16. In addition, the second embodiment does not have a status data reader 14 
in remote module 16a, but does additionally include test voltage source 64 and 
test voltage monitor 66 and 84 pairs in the central module 15a. Referring to 
Fig. 4 a network 17a that includes the communication system is shown. Hub 1 
connects to central module 15a, which connects to remote module 16a, which 
connects to PC 3A. Also connected to central module 15a and remote module 
16 are external devices 19 and 18. Although the central module 15a and 
remote module 16a are each shown connected to a single external device it is 
within the scope of the invention to connect multiple external devices to the 
modules 15a and 16a. Some of the external devices that are envisioned 
include motion detectors and glass breakage detectors. 

Referring to Figs. 5 and 6, the central module 15a is depicted. A receive 
pair of conductors from the hub 1 pass through connector 67 (Fig. 6) and 
connect to blocking circuit 20, test voltage source 64, and test voltage monitor 
66. A +15 volt source with series resistor 65 comprises test voltage source 64. 
A comparator 68 with a resistor divider circuit comprises the test voltage 
monitor 66. Diode 70 connects from the divider circuit to the power input of 
comparator 68 to suppress voltage transients at the input to comparator 68. A 
low power TLC2274ACD is employed for comparator 68 of the present 
embodiment. The test voltage source 64 and test voltage monitor 66 pair 
monitor the receive conductors to ensure the hub 1 is connected to central 
module 15. Blocking circuit 20 includes high pass filter 60, relay 61, and high 
pass filter 62 which connects to a receive pair of conductors from the remote 
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module 16. High pass filter 62 also connects internally to signal receiver 6. 
High pass filters 60 and 62 block DC current flow and isolate the relay 61 from 
driver circuits of hub 1 and PC 3A to enable the central module 15a to continue 
to monitor the conductors from the remote module 16a. Signal receiver 6 
comprises an isolation transformer 72, low pass active filter 74, and comparator 
76. The output of comparator 76 is decoded by Manchester decoder 5 and 
then sent to firmware kernel 4. A processor 77 is employed to implement the 
kernel 4 and status data encoder 9 functions. The processor 77 in the 
illustrated embodiment is a Microchip PIC16C62. Internal to the processor 77 
data received from internal and external signals is encoded and then outputted 
to signal modulator 7 which comprises NPN transistor 78 and PNP transistor 80 
arranged in a level shifter configuration. The output of signal modulator 7 is 
diode OR'd with the output of isolation power supply 8 and then connects to 
one of the transmit data lines that connect to remote module 16. The return 
path for current from PC 3A is the pair of receive data lines. Test voltage 
monitor 84 operates in a manner similar to test voltage monitor 66 to ensure PC 
3A is physically attached to the network 17. Firmware kernel 4 controls the 
operation of blocking circuit 88 which is connected across the transmit data 
lines that connect to hub 1 . High pass filter 86 blocks DC current from flowing 
to hub 1 from signal modulator 7 and additionally provides isolation between 
blocking circuit 88 and the drivers of PC 3A. Connector 90 provides the 
interface for signals from central module 15a to the cable that interfaces with 
remote module 16a. 

Referring to Figs. 7 and 8, the remote module 16a of the second 
embodiment is illustrated. The receive data lines from central module 15a pass 
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through connector 101 (Fig. 8) and connect to high pass filter 100 and signal 
transmitter 12. High pass filter 100 blocks the DC current that flows from 
central module 15a from flowing into the input circuit of PC 3A. Signal 
transmitter 12a, which comprises resistors 104 through 109 and bypass 
capacitor 110, impresses across the receive data lines a variable current 
source that is controlled by firmware kernel 10. Connected to a transmit line is 
isolation power supply 13 which receives power from central module 15a. The 
isolation power supply 13 comprises resistor 112, filter capacitor 113, and zener 
diode 114. The regulated voltage developed across zener diode 114 provides 
power for firmware kernel 10 as well as a number of pull-up resistors. Although 
a Microchip PIC12C508 processor is employed for firmware kernel 10 in the 
illustrated embodiment, there are numerous other devices from manufacturers 
such as SGS Thompson and Burr-Brown that may be employed. The outputs 
from remote module 16a pass through connector 116 which connects to PC 
3A. 

Referring to Figs. 4 and 5, the operation of the second embodiment will 
be described. The existence of a connection between hub 1 and central 
module 15a is monitored by test voltage source 64 and test voltage monitor 66 
through a pair of receive data lines. Current from test voltage source 64 flows 
through a data line to an isolation transformer within hub 1. The current flows 
through the primary winding of the isolation transformer and returns on the 
other receive data line to the test voltage monitor 66. An interruption in the flow 
of current is detected by the test voltage monitor 66. A detailed description of 
the operation of test voltage source 64 and test voltage monitor 66 is provided 
in U.S. Patent 5,406,206 which is hereby incorporated by reference. Similarly, 
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current sourced onto a transmit line from signal modulator 7 and isolation 
power supply 8 through remote module 16a to the isolation transformer of PC 
3A which returns on the other transmit line is monitored by test voltage monitor 
84 to verify that both remote module 16a and PC 3A are connected to central 
module 15a. Signal modulator 7 additionally supplies power to remote module 
16a. A signal from firmware kernel 4 controls NPN transistor 78 which likewise 
controls level-shifting PNP transistor 80. When PNP transistor 80 is ON, 20 
volts is sourced onto the transmit line. When transistor 80 is OFF, 15 volts is 
sourced onto the transmit line. Referring to Fig. 8, the sourced power from 
central module 15a flows through resistor 112 and into zener diode 114 and 
capacitor 113 which provide a regulated voltage to the circuit. In this 
embodiment the status data transmitted from the central module 15a is not 
decoded. However, it is within the scope of the invention to receive the 
encoded data by monitoring various signals, such as the voltage amplitude of 
the data line relative to ground, the voltage across resistor 112, and the current 
through resistor 112. 

In response to external signals as well as internally programmed 
routines, the firmware kernel 10 outputs a signal to Manchester encoder 11. A 
processor 102 incorporates both the kernel 10 and Manchester encoder 11 
functions. In the illustrated embodiment a Motorola PIC12C508 is employed as 
processor 102. The output of the processor 102 is a Manchester encoded 
signal that drives the balanced resistor network that comprises signal 
transmitter 12a. A capacitor 110 and resistors 106 and 107 can be added to 
signal transmitter 12a to provide increased filtering of high frequency 
components. However, the embodiment does not require their addition as 



9919-000002/COC 

17 

firmware control and line capacitance provide sufficient attenuation to prevent 
the encoded signal from interfering with normal network communications. The 
encoded signal flows through resistors 104 and 105 onto the receive data lines 
to central module 16. High pass filter 100 prevents the encoded signal from 
being conducted through the receive data lines to PC 3A. Although the 
encoded signal in the present embodiment transmits the encoded signal from 
the remote module 16a, it is within the scope of the invention to source current 
from the central module and alter the flow of current from within the remote 
module 16a by changing the impedance of a circuit connected across the data 
communication link 2A. Examples of such circuits include an RC network 
connected directly to the data link 2A and reflecting an impedance change 
across an isolation transformer. 

Referring again to Fig. 6, the encoded signal is received in the central 
module 15a by signal receiver 6. Within central module 15a, high pass filter 62 
prevents the encoded signal from being conducted through the data lines to 
hub 1 . The signal couples through transformer 72 to low pass active filter 74 
which filters out normal network communications signals. The filtered signal is 
squared-up by comparator 76 and outputted to Manchester decoder 5. The 
decoded signal is inputted to firmware kernel 4 which evaluates the information. 
If the signal represents the port ID or wall jack location, the kernel 4 outputs a 
signal to external device 19. If the signal provides identification of remote 
module 16, the kernel 4 compares the received identification with the expected 
identification. If an invalid identification is received, the firmware kernel 4 sends 
signals to blocking circuits 20 and 88 commanding them to short the receive 
data lines together and the transmit data lines together. The kernel 4 
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additionally sends an alarm notifying external device 19 that an invalid 
identification has been received. Although the embodiment passes a single 
signal through the decoder circuit, it is within the scope of the invention to feed 
encoded signals from multiple sources through a multiplexer into a single 
decoder circuit, or to implement the decode function in firmware or software, or 
to multiplex the outputs of multiple decoder circuits. It is also within the scope 
of the invention to couple the signal from the receiver data lines through an 
isolating device into a microprocessor wherein the low pass filtering and 
decoding functions are implemented. Envisioned isolating devices include 
devices such as transformers, opto-isolators, and balanced operational 
amplifier circuits. Additionally, it is within the scope of the invention to integrate 
all the functions of the remote module into a processor that interfaces either 
directly to the data lines or through an isolating device. 

A third embodiment of the invention is illustrated in Fig. 10 which 
generally differs from the earlier described embodiments by illustrating in detail 
a circuit as described in the first embodiment wherein current that is sourced 
through a current loop extending from central module 15b to remote module 
16b is modulated in remote module 16b and then decoded in central module 
15b. The embodiment comprises a central module 15b and remote module 
16b that are connected within an existing network 17b. The central module 15b 
comprises a test voltage source 117 and a receiver circuit 119. The test 
voltage source 117 includes a +15 volt source with series resistor 118 for 
sourcing current onto a transmit data line. The receiver circuit 119 comprises a 
signal receiver 6, a Manchester decoder 5, and firmware kernel 4b, for 
receiving and decoding the return current from the receive data lines. 
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Remote module 16b includes an isolation power supply 13 that 
regulates and filters power that is received from central module 15b over a pre- 
existing cable. The isolation power supply 13 supplies regulated power to a 
processor 122 and circuitry that comprises the signal transmitter 12b. The 
processor 122 employed in the illustrated embodiment is a Microchip 
PIC12C508. The processor 122 and exclusive OR gates 120 and 121 
implement both the firmware kernel 10 and Manchester decoder 11 functions. 
An isolation transformer 124, bypass capacitor 110, and resistors 126-129 
comprise the signal transmitter 12b which modulates the current from isolation 
power supply 13 that returns to central module 15b. Capacitors 130 and 132 
comprise a high pass filter that blocks the transmitted signal from interfering 
with normal network communications. 

Continuing to refer to Fig. 10, the operation of the third embodiment will 
be described. Within central module 15b, power flows from the +15 volt source 
through series resistor 118 and a transmit data line, to the isolation power 
supply 13 in remote module 16b. Within remote module 16b, power from the 
transmit data line is regulated by zener diode 114 and filter capacitor 113. The 
current which flows through resistor 112 splits, with a portion flowing through 
processor 122 and the exclusive OR gates, and the remainder flowing through 
zener diode 114. The return current flowing out of zener diode 114 and the 
circuit ICs, flows into the secondary winding center-tap of isolation transformer 
124. The current splits between the windings with the reflected primary 
impedance controlling the magnitude of the current that flows in each winding. 
The primary impedance is controlled by processor 122, the exclusive OR gates 
120 and 121, and the two 10k resistors 126 and 127. A high logic level output 
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from exclusive OR 120 results in current flowing through resistor 126, the 
primary of isolation transformer 124, resistor 127, and into exclusive OR 121. 
The current flowing through the transformer primary is reflected to the 
secondary where it adds with current flowing through one winding and subtracts 
from current flowing through the other winding. The direction of the current 
flowing through the primary changes as the output of exclusive OR 120 
alternates between a logic level high and low in response to the Manchester 
encoded stream from processor 122. The variation in primary current flow 
direction added to the secondary current flowing into the center-tap results in a 
modulated current signal. The high frequency components of the resulting 
secondary winding current flow through bypass capacitor 110. The low 
frequency components flow through resistors 128 and 129, onto the receive 
data lines, to the central module 15b, and through isolation transformer 72 to 
signal ground. Resistors 128 and 129 provide a buffer to prevent the bypass 
capacitor 1 10 from loading down the data lines. 

Within central module 15b, the modulated current is reflected from the 
primary to the secondary of isolation transformer 72. Low pass active filter 74 
filters out high frequency network communication components and passes a 
squared-up output to the Manchester decoder 5. The decoded data stream is 
inputted to the firmware kernel 4 which evaluates the data stream to ensure a 
valid identification number was transmitted. 

Referring to FIG. 18, a presently preferred embodiment, the fourth 
embodiment, of the invention is illustrated. The fourth embodiment differs from 
the earlier described embodiments by employing an interface amplifier for the 
signal receiver 6c in place of an isolation transformer, adding a third source 
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voltage to central module 15c, adding a NIC Stick 170, reconfiguring the signal 
transmitter of the remote module 16c, and adding an electronic tether 150. The 
signal receiver interface amplifier is configured as a bandpass filter using 
design techniques that are well known in the art. The output of the interface 
amplifier is connected to the processor 77 wherein the signal is decoded. The 
NIC Stick 170 provides an improved method of interconnecting the signals that 
flow between the various modules of the preferred embodiment. The NIC Stick 
170 and remote module 16c are integrated into a connector assembly for 
interconnect to a PC. The purpose and function of the tether 150 is provided in 
a subsequent section of this specification. 

Turning now to FIGS. 11-13 the remote module 16 is illustrated as being 
contained in a special box-like housing 23. The electronics are mounted on a 
suitable card 22 within the confines of a container 24. The container 24 is 
mounted to the computer 3A using the existing fasteners normally found on the 
back of the computer. Such a fastener is illustrated at 26. The fastener 26 is 
chosen to be one that is required to be removed in order to gain access to the 
hardware inside the computer. Therefore, the potential thief must remove 
fastener 26 to steal the mother board, network identification card (NIC), etc. Lid 
32 likewise contains opening 34. When the lid is closed as shown in FIG. 13, 
the opening 28 is aligned with opening 34. These openings allow the normal 
network wire connector 38 to pass through the openings in housing 23 and 
engage the electronics card 22. Housing 23 includes an output cord 40 with a 
connector 42 which engages the standard network interface card (NIC) found in 
the computer. This construction is designed to require the potential thief to 
disconnect connector 38 from housing 23 in order to gain access to the 
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fastener 26 which must be unscrewed in order to remove the internal computer 
parts. When the connector 38 is removed, the computer 3A becomes, likewise, 
disconnected from the network. This causes the current in loop 2A to drop 
below a threshold level which causes the system 1 5 to cause a system alarm or 
the like to be activated. Thus this housing configuration deters theft of the 
internal parts of the computer since fastener 26 must be removed to gain 
access to them, as well as deterring removal of the entire computer terminal. 

FIGS. 14-15 show an alternative embodiment in which the electronics for 
network identification circuitry 16 are instead placed upon a card 44 which can 
be inserted into an adjacent slot in the computer next to the standard NIC card 
46. The network wire connector 38 is connected to the input of card 44 and the 
output of identification card 44 is then connected to the normal input receptacle 
48 of NIC card 46. It is also envisioned that the electronics of the network 
identification circuitry can be placed on a motherboard within the computer or 
as part of the circuitry on the NIC card. 

Fig 16 shows a schematic of another implementation in which the 
electronic tether 150 extending from the remote module 16 is attached to 
equipment to be protected. The remote module 16 monitors the status of the 
tether 150 and notifies the central module 15 if the tether 150 is removed or the 
electrical connection interrupted. The central module then sets a system alarm 
either centrally or locally. The tether 150 includes two conductive lines 152 and 
154 coupled between a pair of connectors 156 and 158. An attachment status 
signal is conducted through the conductive lines 152 and 154 for indicating 
whether the tether 150 remains attached to the protected equipment. The first 
conductive line 152 includes pads P1 and P2 inline to provide a means of 
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shorting a break in the line. The second conductive line 154 is coupled directly 
between the connectors. An external jumper 160 is connected to the output 
connector 158 of the tether 150 to complete the electrical connection. 

Fig. 17 illustrates the electronic tether 150 mounted to the surface of 
equipment to be protected. A conductive pad 162 having conductive adhesive 
on both sides is bonded to the equipment surface. The adhesive on the side 
facing the equipment has greater strength than the adhesive on the side facing 
the tether. The relative strength of the adhesive on either side of the 
conductive pad 1 62 is chosen to ensure that if the tether 1 50 is removed the 
conductive pad 162 will remain bonded to the equipment, not to the tether. The 
tether 150 is bonded to the conductive pad 162 so that the pads, P1 and P2, 
make electrical contact with the conductive pad 162. 

In operation, the tether 150 is bonded to a piece of equipment to be 
protected such as monitors, printers, fax machines, and chairs. Multiple tethers 
can be connected in series to provide protection for more than one piece of 
equipment. The remote module 16 monitors the status of the attachment 
status signal from the tether 150 to determine that an electrical short is 
maintained. An interrupted attachment status signal indicates that either a 
tether 150 is no longer connected to its associated piece of equipment or the 
electrical connection to the tether 150 has been interrupted. Upon detecting an 
interrupted attachment status signal, the remote module 16 sets a bit of the 
identification number that is transmitted to the central module 15. The central 
module 1 5 then sets an alarm either locally or centrally. 

From the foregoing it will be understood that the invention provides a 
system for communicating with electronic equipment on a network. The system 
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transmits a signal over pre-existing network wiring or cables without disturbing 
network communications by coupling a signal that does not have substantial 
frequency components within the frequency band of network communications. 
The system is particularly suitable for high-frequency networks such as 
Ethernet operating at speeds of 10 megabits per second (Mb/s) and higher. 
For purposes of this invention the term "high frequency information" means the 
band of frequencies needed to carry data at 10 Mb/s or more. Coupling a lower 
frequency signal to the data lines of such a network permits increased 
utilization of the available transmitting medium without a commensurate 
increase in the cost of the network. To ensure that the added lower frequency 
signal does not interfere with normal network communications the added signal 
must not contain frequency components that interfere with the network signals. 
For example, when the invention is used with an Ethernet 1 0BASE-T network, 
the specifications for that network method place stringent restrictions on the 
behavior of the medium for frequencies from 5 MHz to 10 MHz with some 
parameters specified to frequencies as low as 1 MHz. In the present 
embodiment a simple highpass circuit at 150 kHz formed by adding capacitors 
into each wire of the medium is employed to isolate the injected signal from 
normal network communications, resulting in substantially no disruption of the 
high frequency network information. Additionally, employing a higher order high 
pass filter would permit operation with less disruption than a lower order high 
pass filter at the same corner frequency. For the purposes of the invention, the 
term "low frequency signal" means signals in which the energy representing the 
data can be reliably carried in the band of frequencies made available by this 
filtering. Typically, this means that the low frequency signals operate at a bit 
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rate which is less than about 1% of the bit rate of the high frequency signals 
which carry the network communication data. By way of a specific example, 
the high frequency information in the embodiment of Figs. 4-8 operates in the 
range of about 10 Mb/s while the encoded signal sent from remote module 16a 
to central module 15a operates in the range of about 1200 bits per second. 
Although the present embodiment operates in the range of about 1200 bits per 
second, it is within the scope of the invention to operate at bit rates up to 57.6 
kb/s by increasing the filter frequencies, operating in a lower noise environment, 
or increasing the degradation of network communications. Further suppression 
of harmonics results from the lowpass filtering provided by the resistors used to 
couple the low frequency signal to the data lines acting with the capacitors used 
for the highpass function mentioned above. 

Additionally, the system provides a means for permanently identifying 
the location of network assets without applying power to the assets. Also, the 
system can be employed to determine asset inventory, i.e. when an asset is 
being removed or added to the network. The system permits a company to 
track its assets, locate any given asset, and count the total number of identified 
assets at any given time. In addition, the system provides a means of blocking 
communications with an unauthorized device that is connected to the network. 
Furthermore, the system allows the automatic blocking of communications with 
an unauthorized device. Additionally, the system is particularly suitable to be 
integrated into an asset aware patchpanel in order to provide a means for 
identifying the location of network assets. 

Referring to Figs. 21 and 22, a system 200 for communicating with 
equipment is illustrated. The system provides a means of assigning a 
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permanent electronic identification number to an object. The object electronic 
number is used to monitor the configuration of the object, to control access to 
network entities such as programs and servers, and to provide network 
management information. The initial configuration of a network device is stored 
and referenced in a network database by the object identification number, 
permitting subsequent comparisons between the initial configuration and the 
subsequent configuration of the network device. Another permanent electronic 
number may be assigned to the physical location of the object. The location 
electronic number combined with the object electronic number provides 
simultaneous references for location and configuration of an object. The 
network database further includes the location associated with the location 
identification number, thereby permitting between the initial location and 
configuration, and the subsequent location and configuration of an object. The 
system 200 includes an ID sender tag 202 that has a unique identification 
number and is physically attached to an object 204. In the preferred 
embodiment the identification number is programmed at manufacture and is 
not changeable. Once the ID sender tag 202 is attached to an object, the 
identification number becomes associated with that object 204. In the presently 
preferred embodiment of the invention, a first sender tag 202 is attached to a 
computer 204a and a second sender tag 202 is attached to a wall 204d near 
the computer 204a. However, other objects are within the scope of the 
invention, such as desks 204b, monitors 204c, computer pointing devices, other 
computers (powered and unpowered), and clothing. The first sender tag 202 
provides identification information and the second sender tag 202 provides 
location information. Each sender tag 202 transmits a serial stream that 
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includes a unique identification number corresponding respectively to the 
computer 204a and the wall 204d. A decoder plug 206 attached to a computer 
port is electronically coupled to the sender tag 202. The decoder plug 206 
receives the serial stream, and then converts the serial stream into a signal 
format that is compatible with the port to which the decoder plug 206 is 
connected. Although, in the presently preferred embodiment the decoder plug 
206 is connected to a computer parallel port 210, the principles of the invention 
may be readily extended to other types of ports, such as USB, Firewire, 
keyboard, and serial ports. In addition, the scope of the invention includes 
coupling multiple ID senders 202 to a single decoder plug 206 so that multiple 
objects can be monitored with the decoder plug 206. Also, connecting multiple 
decoder plugs 206 in series is within the scope of the invention. The decoder 
plug 206 includes an identification number, thereby permitting the 
interconnected decoder plugs 206 and ID sender tags 202 to be logically linked 
together. The parallel port 210 is included within the computer 204a, which is 
connected to a network 212. Referring to Fig. 19a, a port reader 218 in the 
computer 204a reads the converted serial stream at the parallel port 210 and 
sends the communicated information over the network 212. The scope of the 
invention includes employing pre-existing collector software as an interface to 
the port reader for communicating with the decoder plug 206. A server 214 
connected to the network 212, includes a control manager 216 that receives 
and analyzes the communicated information. The control manager 216 
includes a database for storing communicated information such as initial and 
subsequent locations and configurations for identified objects. Although the 
presently preferred embodiment of the invention includes a port reader 218 and 
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a control manager 216, the principles of the invention may be practiced with 
merely an ID sender tag 202 electronically coupled to a decoder plug 206. 

Referring to Fig. 19b in addition to Fig. 19a, the mounting configuration 
of the sender tag 202 is illustrated. A mounting arrangement similar to that of 
the electronic tether 150 described in an earlier section of this specification is 
employed to mount the sender tag 202 to the surface of an object. The sender 
tag 202 includes pads 205 for mounting. A conductive pad 203 having 
conductive adhesive on both sides is bonded to the pads 205 for attaching the 
sender tag 202 to an equipment surface. The adhesive on the side facing the 
equipment has greater strength than the adhesive on the side facing the pads 
205. The relative strength of the adhesive on either side of the conductive pad 
203 is chosen to ensure that if the sender tag 202 is removed the conductive 
pad 203 will remain bonded to the equipment, not to the pads 205 of the 
sender tag 202. With the conductive pad 203 attached to the sender tag 202 
an electrical connection is established between the pads 205. 

Referring to Fig. 20 in addition to Fig. 19a, the ID sender tag 202 of the 
presently preferred embodiment is illustrated. The ID sender tag 202 is a 
physical identifier that has an identification number that is programmed at 
manufacture. The identification number is remotely readable through a 
communication interface that is continuously operable and parasitically 
powered. The ID sender tag 202 includes a processor 220 for Manchester 
encoding and sending the identification number over the attached serial bus. 
Although, Manchester encoding is employed in the preferred embodiment, 
other forms of transmitting a serial stream are within the scope of the invention, 
such as single bit on/off, 4B/5B, Frequency Shift Keying (FSK), and techniques 
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that result in a DC bias on the line. Regulating and filtering the power for the 
processor 220 is provided by circuitry that is configured using design 
techniques that are well known in the art. Additionally, a set of resistors is 
selected using design techniques that are well known in the art to buffer the 
output of the processor 220 from the serial bus. The firmware of processor 220 
is programmed to provide an ID manager 222 function. The ID manager 222 
generates an identification packet using procedures for Manchester encoding 
and RS232 framing of a unique identification number. Table I includes 
pseudocode of the procedures carried out by the ID manager 222. 



Table I. 



Pseudocode for ID Manager 

Retrieve the data words containing the identification number. 

Load the data words containing the identification number into RAM. 

Begin Encode Loop 

Begin transmitting information. 

Set the start bit to begin the first half of the Manchester cycle. 

Load a data word 

Pad out time and set the end bit. 

Set the start bit to begin the second half of the Manchester cycle. 
Load a data word. 
Pad out time and set the end bit. 
Set RS-232 framing 
Loop until the packet is complete 



Referring to Fig. 20 in addition to Fig. 19a, the decoder plug 206 of the 
presently preferred embodiment is illustrated. The decoder plug 206 is a 
physical reader that has an identification number that is programmed at 
manufacture. The continuously operable and parasitically powered 
communication interface permits the decoder plug 206 to remotely read the 
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identification number of an attached ID sender 202. The decoder plug 206 
includes a signal receiver 230, a processor 232, and a voltage regulator 234. 
The signal receiver 230 provides a balanced impedance on the serial bus for 
receiving the serial stream from the sender tag 202. The buffered serial stream 
is coupled from the output of the signal receiver 230 to an input of the 
processor 232 which converts it into a parallel stream. Firmware in the 
processor 232 implements an ID reader module 236 to provide the conversion 
function. A tri-state buffer 233 coupled to the processor 232 permits 
unobstructed passthrough communication from the interface port 210 to a 
peripheral device coupled to the decoder plug 204 through a connector 235. 
Power, Vcc, from the parallel port is regulated by the voltage regulator 234 and 
used to power the processor 232 and signal receiver 230. Table II provides 
pseudocode of the ID reader module 236. 



Table II. 



Pseudocode for ID Reader Manager 
Load the Manchester encoded data. 

Perform a majority sample decode (converts the Manchester symbols to a bit 
stream) 

Strip the start and end bits. 
Output a series of bytes. 
Assemble the bytes into a message. 
Perform error and checksum testing. 
Store the message. 



In operation, the communication system has multiple operating modes, 
such as asset control mode, network management information mode, and 
license control mode. In asset control mode the system provides external 
identifiers as a guaranteed reference for computer change control including 
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change of location and change of configuration. During network management 
information mode the system automates the physical management and 
inventory of equipment. In license control mode the system trades access to 
the computer in exchange for a physical inventory of the connected identifiers. 

With reference to Figs. 19a and 20, during asset control mode the 
control manager 216 located in the server 214 sends an asset identifier request 
to the port reader 218 requesting the identification number of equipment that is 
monitored by the computer 204a. The asset identifier request is passed 
through the decoder plug 206 to each of the ID sender tags 202 that are 
associated with the computer 204a. The ID manager 222 in each ID sender 
tag 202 Manchester encodes a predefined identification number and transmits 
the encoded number to the decoder plug 206 as a serial stream with RS-232 
framing. The ID reader module 236 in the decoder plug 206 performs a 
majority sample decode to convert the Manchester symbols to a bit stream. In 
addition, the reader module 236 provides the equivalent of a UART by stripping 
the start and end bits and outputting a series of bytes. The bytes are then 
assembled into an ID sender message and stored after appropriate error and 
checksum testing. The decoder plug 206 then formats the stored sender 
messages for transmission to the interface port 210. First, a decoder message 
is assembled, consisting of identification information related to the decoder plug 
206, status information, and the stored sender messages. Second, a 
MAC/physical layer which handles the interface and handshaking to the 
interface port 210 is constructed. The decoder plug 206, then transmits the 
assembled decoder information to the interface port 210. The port reader 218 
receives the assembled decoder information, reformats the enclosed messages 



9919-000002/COC 

32 

and transmits the reformatted messages to the control manager 216. The 
control manager 216 evaluates the response from the computer 204a. The 
evaluation by the control manager 216 includes comparing and updating the 
configuration and location information of the queried objects with previously 
stored information in the associated database. The initial physical identity and 
initial physical location of an object is input to the database during setup of an 
ID sender tag 202 by an operator such as a user. Information related to the 
object is also inputted to the database. Related object information includes the 
object serial number, physical attributes, physical configuration, electronic 
attributes, software configuration, network attributes, and date of entry. 

Continuing to refer to Figs. 19a and 20, during network management 
information mode a network manager determines the location or configuration 
of assets that are coupled to the network by interrogating ID senders 202 and 
decoder plugs 206 attached to assets. The system is especially useful for 
token ring and fiber optic networks since the location information related to an 
object is provided by an ID sender tag 202 attached to a relatively immobile 
surface rather than reading a port address associated with a network device. 
The method of interrogating the ID sender tags 202 is similar to that employed 
during asset control mode except asset configuration information is requested 
instead of merely identification of attached objects. 

During license control mode a key manager located in server 214 limits 
access to selected programs to predetermined assets or a quantity of assets 
rather than to predetermined users or a quantity of users. In response to a user 
attempting to open a controlled program, the key manager ascertains the asset 
the user is employing and the identification number assigned to the asset in a 
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similar manner to that described for asset control mode. The key manager 
then employs access criteria to determine whether to grant access to the 
controlled program. 

Although, in the preferred embodiment the comparison function of the 
control manager and database is executed on a network server electronically 
coupled through a network to an ID sender tag 202, the scope of the 
invention includes conducting the comparison locally on a computer that is 
being scanned, in a central database over a network, over a corporate 
intranet, and over the world wide Internet. 

In operation, an application which runs "Java" through a standard 
browser is provided. A requestor connected to the Internet selects a button to 
request related object information from an Internet connected object. In 
response to the request, an ActiveX (Java) control gets pulled down onto a 
computer connected to the object, runs and reads the object identification 
number and the object location identification number from ID sender tags 
202. The computer reports the related object information back to the 
requester over the Internet. 

From the foregoing it will be understood that the invention 
provides a system and method for remotely detecting and reading an asset 
identity and location. Additionally, the system and method can be employed to 
automate collection and validation of asset identity and location. The system 
and method provide a means for communicating with an asset based on 
identity or location. In addition, the system and method permit the automated 
comparison and storage of asset configuration and location information. Also, 
the system and method can be employed to automate asset change control. 
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Additionally, the system and method provide a means to perform asset 
management, remote identification, and remote access security over the 
Internet in a guaranteed fashion. 

The attachment of a remote module 16 or an ID sender tag 202 to an 
object provides an identification number corresponding to the object. The 
location of an object with an attached remote module 16 is provided by the 
corresponding port address associated with the object. The location of an 
object with an attached ID sender tag 202 is provided by an associated ID 
sender tag 202 that is attached to a surface of a wall, floor, or other relatively 
immobile object. 

It should be understood that while this invention has been described in 
connection with particular examples thereof, no limitation is intended thereby 
since obvious modifications will become apparent to those skilled in the art after 
having the benefit of studying the foregoing specification, drawings and 
following claims. 



